Python CPython <3.16 ZIP bzip/LZMA/Zstd Decompression Memory Exhaustion
CVE-2026-15310 Published on August 25, 2026
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
Vulnerability Analysis
CVE-2026-15310 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-15310 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-15310
Want to know whenever a new CVE is published for Cpython? stack.watch will email you.
Affected Versions
Python Software Foundation CPython:- Before 3.16.0 is affected.